OTRS Authenticated Remote Code Execution (OSA-2017-07)

The version of OTRS running on the remote host is 3.3.x prior to 3.3.20, 4.0.x prior to 4.0.26, or 5.0.x prior to 5.0.24. It is, therefore, affected by a remote code execution vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid105156; scriptversion"1.4";...

OTRS 4.x < 4.0.27, 5.x < 5.0.24, 6.x < 6.0.2 RCE Vulnerability (Dec 2017)

OTRS is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:otrs:otrs"; if...

OTRS Unspecified Remote Code Execution (OSA-2017-04)

The version of OTRS running on the remote host is 3.3.x prior to 3.3.18, 4.0.x prior to 4.0.25, 5.0.x prior to 5.0.23 or 6.0.x prior to 6.0.beta2. It is, therefore, affected by a remote code execution vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description...

OTRS 3.3.x < 4.0.27, 5.x < 5.0.24, 6.x < 6.0.2 Information Disclosure Vulnerability (Dec 2017)

OTRS is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:otrs:otrs"; if...

Open redirect

In Open Ticket Request System OTRS through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets...

CVE-2017-16854

In Open Ticket Request System OTRS through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets...

CVE-2017-16854

In Open Ticket Request System OTRS through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets...

CVE-2017-16854

In Open Ticket Request System OTRS through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets...

CVE-2017-16854

The CVE-2017-16854 issue affects Open Ticket Request System (OTRS) up to versions 3.3.20, 4.x up to 4.0.26, 5.x up to 5.0.24, and 6.x up to 6.0.1, where an authenticated customer can use the ticket search form to disclose internal article information in customer tickets. Connected advisories conf...

CVE-2017-16854

In Open Ticket Request System OTRS through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets...

CVE-2017-16854

Removed by vendor...

CVE-2017-16921

In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters related to PGP and execute arbitrary shell commands with the permissions of the OTRS or web...

Command injection

In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters related to PGP and execute arbitrary shell commands with the permissions of the OTRS or web...

CVE-2017-16921

In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters related to PGP and execute arbitrary shell commands with the permissions of the OTRS or web...

CVE-2017-16921

In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters related to PGP and execute arbitrary shell commands with the permissions of the OTRS or web...

CVE-2017-16921

Removed by vendor...

CVE-2017-16921

In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters related to PGP and execute arbitrary shell commands with the permissions of the OTRS or web...

CVE-2017-16921

CVE-2017-16921 affects OTRS 4.0.x up to 4.0.26, 5.0.x up to 5.0.24, and 6.0.x up to 6.0.1. An authenticated agent can manipulate form parameters (PGP-related) and execute arbitrary shell commands with the permissions of the OTRS/web server user. Multiple Nessus/OpenVAS entries corroborate remote ...

openSUSE Security Update : otrs (openSUSE-2017-1291)

This update for otrs fixes the following security issues : - CVE-2017-15864: Remote authenticated attackers could have caused otrs to disclose configuration information, including database credentials boo1068677, OSA-2017-06 - CVE-2017-16664: Remote authenticated attackers could have caused the...

openSUSE: Security Advisory for otrs (openSUSE-SU-2017:3054-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...